)]}'
{
  "commit": "d464ae8a58fa3589bc5dea2533782cf30ec52985",
  "tree": "eb7d93223e3563c21921a9307827dda52400f205",
  "parents": [
    "701f675d9205f7c4c0f77d4cdc925fee855b6cb9"
  ],
  "author": {
    "name": "Adil Burak Şen",
    "email": "56400880+adilburaksen@users.noreply.github.com",
    "time": "Mon Aug 31 13:30:54 2026 +0300"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Mon Aug 31 12:30:54 2026 +0200"
  },
  "message": "bcr-pr-reviewer: pin auto-merge to the analyzed head SHA (#2653)\n\n## Problem\n\nIn `actions/bcr-pr-reviewer/index.js`, `reviewPR()` re-fetches the PR\nhead SHA and aborts if it changed since the analysis began (the\n`initialHeadSha !\u003d\u003d currentHeadSha` check). However, the subsequent\nauto-merge call:\n\n```js\nawait octokit.rest.pulls.merge({\n  owner, repo, pull_number: prNumber, merge_method: \u0027squash\u0027,\n});\n```\n\ndoes not pass a `sha`, so it merges whatever the PR head is at merge\ntime. There is a window between the staleness check / approval and this\nmerge in which a new commit could be pushed, causing the bot to merge\ncontent that was not the analyzed and approved commit.\n\n## Change\n\nPass `sha: currentHeadSha` (the commit that was analyzed and approved)\nto `pulls.merge`. GitHub\u0027s merge API rejects the merge with `409\nConflict` if the provided SHA is not the current head, so the bot will\nnot merge commits that were pushed after analysis.\n\nThis is a defense-in-depth hardening of the existing staleness check; it\ndoes not change behavior for PRs whose head is unchanged.",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "3c561b6a3589fe4527f7c73551021241acf5a01d",
      "old_mode": 33188,
      "old_path": "actions/bcr-pr-reviewer/index.js",
      "new_id": "5d04d59532122a1332593b6e20acc613a29a56fe",
      "new_mode": 33188,
      "new_path": "actions/bcr-pr-reviewer/index.js"
    }
  ]
}